1201 matches found
PT-2011-1403
Name of the Vulnerable Software and Affected Versions Horde Gollem versions prior to 1.1.2 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the file parameter in a "view file" action...
CVE-2010-3447: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in view.php in the file viewer in Horde Gollem before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the file parameter in a viewfile action...
PT-2011-1681
Name of the Vulnerable Software and Affected Versions WebSCADA WS100 and WS200 versions affected versions not specified Easy Connect EC150 versions affected versions not specified Modbus RTU - TCP Gateway MB100 versions affected versions not specified Serial Ethernet Server SS100 versions affecte...
PT-2010-5516
Name of the Vulnerable Software and Affected Versions Zimplit CMS versions 3.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. This is possible via the file parameter in a load action to...
Format string
Format string vulnerability in authcfg.cgi in Accoria Web Server aka Rock Web Server 1.4.7 allows remote attackers to have an unspecified impact via format string specifiers in the path aka Password File parameter...
CVE-2010-2019
SQL injection vulnerability in downlot.php in Lokomedia CMS 1.4.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the file parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2010-2018
Directory traversal vulnerability in downlot.php in Lokomedia CMS 1.4.1 and 2.0 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...
CVE-2010-2018: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in downlot.php in Lokomedia CMS 1.4.1 and 2.0 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...
CVE-2010-2019: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in downlot.php in Lokomedia CMS 1.4.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the file parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2010-1652: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the HelpCenter module in Help Center Live HCL 2.0.6 and 2.1.7 allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the file parameter to module.php. NOTE: some of these details are obtained from third...
CVE-2010-0760: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the 1 file parameter to libraries/jquery/js/ui/jsloader.php and the 2 files parameter to...
Directory traversal
Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos JwallVideos plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ modified dot dot in the file parameter...
CVE-2009-3999
Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to execute arbitrary code via a long fileName parameter...
CVE-2009-3787: Improper Limitation of a Pathname to a Restricted Directory
files.php in Vivvo CMS 4.1.5.1 allows remote attackers to conduct directory traversal attacks and read arbitrary files via the file parameter with "logs/" in between two . dot characters, which is filtered into a "../" sequence...
CVE-2008-7134: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the default URI in Chris LaPointe RedGalaxy Download Center 1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 file parameter, 2 message parameter in a login action, 3 category parameter in a browse action, 4 now...
PT-2009-5272 · Pixaria · Pixaria Gallery
Name of the Vulnerable Software and Affected Versions: Pixaria Gallery versions 2.0.0 through 2.3.5 Description: The issue allows remote attackers to read arbitrary files via a base64-encoded file parameter in the pixaria.image.php file. Recommendations: For Pixaria Gallery versions 2.0.0 through...
CVE-2009-2922: Improper Limitation of a Pathname to a Restricted Directory
Absolute path traversal vulnerability in pixaria.image.php in Pixaria Gallery 2.0.0 through 2.3.5 allows remote attackers to read arbitrary files via a base64-encoded file parameter...
PT-2009-2346 · Zen Cart · Zen Cart
Name of the Vulnerable Software and Affected Versions: Zen Cart versions 1.3.8 through 1.3.8a Description: A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files via a .. dot dot in the loader file parameter in admin/includes/initsystem.php when...
CVE-2009-2397
CVE-2009-2397 is a directory traversal vulnerability in the Audio Article Directory’s download.php where an attacker can read arbitrary files by manipulating the file parameter. Affected component: download.php; vulnerable vector: directory traversal sequences in file parameter. Impact as documen...